Which information does a user need to verify a signed container image?

The verification of a signed container image is based on asymmetric (public-key) cryptography. The signing authority uses its secret private key to generate a digital signature for the image. To verify the image's authenticity and integrity, a user needs the digital signature itself and the corresponding public key of the signing authority. The verification process uses the public key to confirm that the signature is valid for the image, proving it was signed by the holder of the private key and has not been tampered with.

A. The private key is used for signing, not verification, and must be kept secret by the signing authority.

B. The private key is exclusively for creating the signature. Distributing it for verification would compromise the entire security model.

C. While the image's hash is used internally during verification, the user needs the actual digital signature, which is the cryptographic proof to be validated.

1. Kubernetes Documentation

"Signing container images": In the "Verify image signatures" section

the documentation states: "To verify the image signature

you need the signer's public key." This explicitly confirms that the public key is required for the verification step.

Source: Kubernetes Authors

Signing container images

Kubernetes Documentation

Concepts > Containers > Images.

2. Sigstore (Cosign) Documentation: The official documentation for the cosign verify command

a standard tool for signing container images

shows its usage as cosign verify --key . This demonstrates that the public key and the image (which has an associated signature) are the necessary inputs for verification.

Source: The Sigstore Authors

Cosign Verify Command Reference

Sigstore Documentation.

3. MIT OpenCourseWare

"6.857 Computer and Network Security

Fall 2017": Lecture 9 on Public-Key Cryptography defines the digital signature scheme. The verification algorithm is formally described as Verify(message

signature

publickey)

which returns true or false. This academic principle directly applies to verifying signed container images.

Source: Rivest

R.

Lecture 9: Public-Key Cryptography

Digital Signatures

MIT OpenCourseWare

6.857

Fall 2017.